in JetBrains.SbomUtils/src/JetBrains.SbomUtils/SbomValidator.cs [89:130]
private FileVerificationResult ValidateFile(IInstalledSoftwareProvider installedSoftwareProvider, string installationFile, List<FileInfo> sbomFiles, HashSet<Package> packagesHashSet)
{
var filesFromReferencedPackages = sbomFiles.Where(f => packagesHashSet.Contains(f.Package)).ToList();
var hashAlgorithms = sbomFiles.SelectMany(f => f.File.Checksums).Select(c => c.Algorithm).Distinct();
var hashesDictionary = installedSoftwareProvider.CalculateFileHashes(installationFile, hashAlgorithms);
if (filesFromReferencedPackages.Any())
{
HashVerificationFailure? hashVerificationFailure = null;
foreach (var sbomFile in filesFromReferencedPackages)
{
hashVerificationFailure = ValidateHashes(hashesDictionary, sbomFile);
if (hashVerificationFailure == null)
break;
}
return new FileVerificationResult(installationFile, hashVerificationFailure == null, hashVerificationFailure, null);
}
else
{
HashVerificationFailure? hashVerificationFailure = null;
FileFromUnreferencedPackage? fileFromUnreferencedPackage = null;
foreach (var sbomFile in sbomFiles)
{
hashVerificationFailure = ValidateHashes(hashesDictionary, sbomFile);
if (hashVerificationFailure == null)
{
fileFromUnreferencedPackage = new FileFromUnreferencedPackage(sbomFile);
break;
}
}
return new FileVerificationResult(
installationFile,
hashVerificationFailure == null && fileFromUnreferencedPackage == null,
hashVerificationFailure,
fileFromUnreferencedPackage);
}
}